Amendments to the Claims 

Please amend the claims as follows: 

1 . (Previously presented) A method comprising: 

grouping single fields of a multiple-field source into a plurality of multiple-field 
keys (MFKs) of a search target, each MFK of the search target having single fields that 
correspond to single fields in one of a plurality of multiple-field vectors (MFVs) of 
entries in a data structure; 

generating a set of queries based, at least in part, on the MFKs, wherein each 
query includes one or more of the MFKs and wherein each query has a different MFK as 
a lead MFK; 

using a query to determine whether the non-wildcard values in the MFVs of an 
entry match the non- wildcard values in corresponding MFKs of the search target; and 

if no entry has non-wildcard values in the MFVs that match the corresponding 
non- wildcard values in the MFKs, then using the queries to determine whether the entry 
has non-wildcard values in a MFV that match the non-wildcard values in a corresponding 
lead MFK, plus remaining MFVs that match corresponding remaining MFKs based on 
matching the non-wildcard values and wildcard values. 

2. (Original) The method of claim 1, wherein the entries of the data structure 
are stored such that the MFVs that have non-wildcard values are located at the end of the 
entry. 
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3. (Original) The method of claim 1 , further comprising arranging the entries 
of the data structure so that the MFVs that have non-wildcard values are placed at the end 
of the entry. 

4. (Original) The method of claim 1, wherein the non- wildcard values 
comprise a fixed value and/or a range of fixed values. 

5. (Original) The method of claim 1, further comprising: 
locating the entry having non-wildcard values in the MFV that match the 

non- wildcard values in the corresponding lead MFK, plus remaining MFVs that match 
corresponding remaining MFKs based on matching the non-wildcard values and wildcard 
values; and 

performing an operation associated with the located entry. 

6. (Original) The method of claim 1, wherein the multiple-field source 
comprises a data packet having single fields in its header. 

7. (Original) The method of claim 6, wherein the operation comprises one of 
the following: dropping the data packet, mirroring, metering, traffic shaping, rate 
limiting, accounting, statistics gathering, providing quality of service (QoS), redirecting 
to a central processing unit (CPU) for further processing, or sampling a subset of the 
packets to a CPU. 

8. (Original) The method of claim 1, wherein fewer than all MFVs in the 
entries include one single field. 
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9. (Original) The method of claim 1, wherein the MFVs in the entries include 
two or more single fields. 

1 0 . (Previously presented) An apparatus comprising : 

a data structure having a plurality of entries, wherein each entry has a group of 
multiple-field vectors (MFVs) that each include a number of single fields having all 
wildcard values or all non-wildcard values; and 

a search unit to group single fields of a multiple-field source into a plurality of 
multiple-field keys (MFKs) of a search target, each MFK having single fields that 
correspond to the single fields in a corresponding MFV of the entries in the data 
structure, generate a set of queries based, at least in part, on the MFKs, wherein each 
query includes one or more of the MFKs and has a different MFK as a lead MFK, use a 
query to determine whether the non-wildcard values in the MFVs of an entry match the 
non-wildcard values in corresponding MFKs of the search target; and, if no entry has 
non-wildcard values in the MFVs that match the corresponding non-wildcard values in 
the MFKs, using the queries to determine whether the entry has non- wildcard values in a 
MFV that match the non-wildcard values in a corresponding lead MFK, plus remaining 
MFVs that match corresponding remaining MFKs based on matching the non-wildcard 
values and wildcard values.. 

1 1 . (Original) The apparatus of claim 10, wherein the entries of the data 
structure are stored such that the MFVs that have non-wildcard values are located at the 
end of the entry. 
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12. (Original) The apparatus of claim 10, wherein the search unit arranges the 
entries of the data structure so that the MFVs that have non-wildcard values are placed at 
the end of the entry. 

13. (Original) The apparatus of claim 10, wherein the non- wildcard values 
comprise a fixed value and/or a range of fixed values. 

14. (Original) The apparatus of claim 10, wherein the search unit locates the 
entry having non-wildcard values in the MFV that match the non-wildcard values in the 
corresponding lead MFK, plus remaining MFVs that match corresponding remaining 
MFKs based on matching the non-wildcard values and wildcard values; and performs an 
operation associated with the located entry; 

15. (Original) The apparatus of claim 10, wherein the multiple-field source 
comprises a data packet having single fields in its header. 

16. (Original) The apparatus of claim 15, wherein the operation comprises one 
of the following: dropping the data packet, mirroring, metering, traffic shaping, rate 
limiting, accounting, statistics gathering, providing quality of service (QoS), redirecting 
to a central processing unit (CPU) for further processing, or sampling a subset of the 
packets to a CPU. 

17. (Original) The apparatus of claim 10, wherein fewer than all MFVs in the 
entries include one single field. 

18. (Original) The apparatus of claim 10, wherein the MFVs in the entries 
include two or more single fields. 
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19. (Currently amended) An article of manufacture comprising: 

a machine accessible computer-readable storage medium including thereon 
sequences of instructions that, when executed, cause an electronic system processor to: 

group single fields of a multiple-field source into a plurality of multiple-field keys 
(MFKs) of a search target , each MFK of the search target having single fields that 
correspond to single fields in one of a plurality of multiple-field vectors (MFVs) of 
entries in a data structure; 

generate a set of queries based, at least in part, on the MFKs, wherein each query 
includes one or more of the plurality of MFKs and wherein each query has a different 
MFK as a lead MFK; 

use a query to determine whether the non-wildcard values in the MFVs of an 
entry match the non- wildcard values in corresponding MFKs of the search target; and 

if no entry has non-wildcard values in the MFVs that match the corresponding 
non-wildcard values in the MFKs, then use the queries to determine whether the entry has 
non- wildcard values in a MFV that match the non-wildcard values in a corresponding 
lead MFK, plus remaining MFVs that match corresponding remaining MFKs based on 
matching the non- wildcard values and wildcard values. 

20. (Original) The article of manufacture of claim 19, wherein the entries of 
the data structure are stored such that the MFVs that have non-wildcard values are 
located at the end of the entry. 

21 . (Currently amended) The article of manufacture of claim 19, wherein the 
machine accessible medium further comprises sequences of instructions that, when 
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executed, cause the electronic system to arrange the entries of the data structure so that 
the MFVs that have non- wildcard values are placed at the end of the entry. 

22. (Previously presented) The article of manufacture of claim 19, wherein the 
non- wildcard values comprise a fixed value and/or a range of fixed values. 

23. (Currently amended) The article of manufacture of claim 19, wherein the 
machine accessible medium further comprises sequences of instructions that, when 
executed, cause the electronic system processor to: 

locate the entry having non- wildcard values in the MFV that match the 
non-wildcard values in the corresponding lead MFK, plus remaining MFVs that match 
corresponding remaining MFKs based on matching the non-wildcard values and wildcard 
values; and 

perform an operation associated with the located entry. 

24. (Original) The article of manufacture of claim 19, wherein the 
multiple-field source comprises a data packet having single fields in its header. 

25. (Original) The article of manufacture of claim 24, wherein the operation 
comprises one of the following: dropping the data packet, mirroring, metering, traffic 
shaping, rate limiting, accounting, statistics gathering, providing quality of service (QoS), 
redirecting to a central processing unit (CPU) for further processing, or sampling a subset 
of the packets to a CPU. 

26. (Original) The article of manufacture of claim 19, wherein fewer than all 
MFVs in the entries include one single field. 
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27. (Original) The article of manufacture of claim 24, wherein the MFVs in 
the entries include two or more single fields. 

28. (Previously presented) A system, comprising: 
a processor; 

a network interface coupled with the processor; and 

an article of manufacture comprising a machine-accessible medium including 
thereon sequences of instructions that, when executed, cause an electronic system to: 

group single fields of a multiple-field source into a plurality of multiple-field keys 
(MFKs) of a search target , each MFK of the search target having single fields that 
correspond to the single fields in one of a plurality of multiple-field vectors (MFVs) of 
entries in a data structure; 

generate a set of queries based, at least in part, on the MFKs, wherein each query 
includes one or more of the plurality of MFKs and has a different MFK as a lead MFK; 

use a query to determine whether the non-wildcard values in the MFVs of an 
entry match the non-wildcard values in corresponding MFKs of the search target; and 

if no entry has non-wildcard values in the MFVs that match the corresponding 
non- wildcard values in the MFKs, then use the queries to determine whether the entry has 
non- wildcard values in a MFV that match the non-wildcard values in a corresponding 
lead MFK, plus remaining MFVs that match corresponding remaining MFKs based on 
matching the non- wildcard values and wildcard values. 

29. (Previously presented) The system of claim 28, wherein the non-wildcard 
values comprise a fixed value and/or a range of fixed values. 
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30. (Previously presented) The system of claim 28, wherein the multiple-field 
source comprises a data packet having single fields in its header. 
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